Data protection has been provided in numerous ways. Many designs for data protection have involved the encryption of data such as sensitive information, passwords, secrets, and so on. An application programming interface (API) or library may be provided on a computer to handle encryption for applications thereon. A simple API might have functions such as protect() and unprotect() with appropriate parameters for incoming data to be protected or unprotected, outgoing unprotected or protected data, keys, group identifiers, etc. As an example, the Windows (TM) operating system has included the DPAPI (TM) (data protection API), for use by application software.
In response to the need to share secure information among users and to provide group-level data protection and access control, data protection facilities such as DPAPI need to be extended to allow groups of related machines or users to share protected data. Distributed Key Management (DKM) services have been used to allow sharing of keys and other grouping functionality. Specifically, a DKM service might provide cryptographic key management services for secure data sharing for distributed applications (for example, as a supplement to the Windows (TM) DPAPI). Some DKM systems may be specifically designed for data centers and cloud services, as well as customer compute clusters and distributed applications. Moreover, like DPAPI, a DKM service might automatically handle key rollover and expiration for users. Some DKM services may use access control lists (ACLs), for example lists of user network identities, to control access to keys for encrypted data.
While there have been many DKM systems available, such systems have relied on software as the basis for security. That is, encryption, key management, key generation, and so forth, have been performed by operating system code, application code, etc., using general purpose central processing units (CPUs) and memory. Techniques discussed below relate to using a hardware security component known as a Trusted Platform Module (TPM) to provide a hybrid hardware-software approach for software-level distributed key management.